CVE-2025-49345: WP-EasyArchives CSRF Vulnerability

CVE-2025-49345 Overview

CVE-2025-49345 is a Cross-Site Request Forgery (CSRF) vulnerability in the WP-EasyArchives WordPress plugin developed by mg12. The flaw affects all versions up to and including 3.1.2. An attacker can craft a malicious request that, when triggered by an authenticated administrator visiting an attacker-controlled page, injects persistent JavaScript into the plugin's stored configuration. The injected payload executes in the browser of any user viewing the affected archive page, resulting in Stored Cross-Site Scripting (XSS). The issue is tracked under CWE-352: Cross-Site Request Forgery.

Critical Impact
A successful attack chains CSRF with Stored XSS to execute arbitrary JavaScript in administrator and visitor browsers, enabling session theft, account takeover, and persistent site compromise.

Affected Products

mg12 WP-EasyArchives plugin for WordPress
All versions from initial release through 3.1.2
WordPress sites with the plugin active and an authenticated administrator session

Discovery Timeline

2025-12-31 - CVE-2025-49345 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-49345

Vulnerability Analysis

The WP-EasyArchives plugin exposes administrative state-changing endpoints without enforcing anti-CSRF protections. WordPress provides the wp_nonce_field() and check_admin_referer() primitives for this purpose, but the affected request handler does not validate a nonce or origin before persisting user-supplied input. An attacker who can lure an authenticated administrator to a malicious page can trigger an automated form submission against the WordPress admin endpoint. The submitted payload is stored by the plugin and rendered without proper output escaping, producing a Stored XSS condition that fires whenever the archive view is loaded.

Root Cause

The root cause is missing CSRF token validation on a privileged plugin action combined with insufficient sanitization of stored input. The handler trusts the authenticated session cookie alone, which the browser attaches automatically to cross-site requests. Because the persisted value is later echoed into HTML without contextual encoding, the CSRF primitive escalates into a Stored XSS sink.

Attack Vector

Exploitation requires user interaction: an administrator must visit an attacker-controlled page or click a crafted link while logged into WordPress. The attacker hosts a hidden form or fetch() call targeting the plugin's settings endpoint with a JavaScript payload as a parameter value. Once stored, the payload executes against any subsequent visitor of the rendered archive page, including other administrators, enabling cookie theft, forced administrative actions, or backdoor account creation.

Refer to the PatchStack advisory for WP-EasyArchives 3.1.2 for additional technical context.

Detection Methods for CVE-2025-49345

Indicators of Compromise

Unexpected <script>, onerror, or onload strings in WP-EasyArchives plugin settings stored in the wp_options table.
WordPress administrator accounts created or role-elevated outside of normal change windows following an admin session.
Outbound browser requests from admin sessions to unknown domains shortly after viewing an archive page.

Detection Strategies

Audit plugin configuration rows in the database for HTML or JavaScript content where only plain text is expected.
Inspect web server access logs for POST requests to WP-EasyArchives admin endpoints lacking a valid _wpnonce parameter or with a Referer header pointing to an external domain.
Deploy a Web Application Firewall (WAF) rule that flags admin POSTs missing nonce parameters or arriving with cross-origin referers.

Monitoring Recommendations

Enable WordPress audit logging to capture plugin option changes and correlate with administrator browsing activity.
Monitor endpoint telemetry on administrator workstations for browser sessions navigating to untrusted sites while WordPress admin tabs are open.
Alert on creation of new administrator users or modification of wp_users and wp_usermeta immediately after plugin setting changes.

How to Mitigate CVE-2025-49345

Immediate Actions Required

Deactivate the WP-EasyArchives plugin until a vendor-patched release above 3.1.2 is available and verified.
Force-logout all WordPress administrators and rotate session cookies, passwords, and application keys.
Review plugin settings, posts, and widgets for injected scripts and remove any unauthorized content.

Patch Information

At the time of publication, no fixed version above 3.1.2 is referenced in the NVD entry or the PatchStack advisory. Site operators should monitor the plugin's repository page for an updated release that adds nonce verification and output escaping.

Workarounds

Remove or disable WP-EasyArchives and replace it with a maintained archive plugin that enforces nonce validation.
Restrict WordPress administrator browsing to dedicated, hardened sessions that do not visit untrusted third-party sites.
Deploy a virtual patch through a WAF to block requests to the vulnerable endpoint that lack a valid _wpnonce parameter.

bash

# Example WAF rule (ModSecurity) blocking CSRF on plugin admin endpoints
SecRule REQUEST_METHOD "@streq POST" \
    "id:1004931,phase:2,deny,status:403,\
    chain,msg:'WP-EasyArchives CSRF attempt - missing nonce'"
    SecRule REQUEST_URI "@contains /wp-admin/" \
        "chain"
        SecRule ARGS_NAMES "@rx wp-easyarchives" \
            "chain"
            SecRule &ARGS:_wpnonce "@eq 0"